PT-2026-38383 · Gotenberg · Gotenberg
Adrgs
·
Published
2026-05-07
·
Updated
2026-05-20
·
CVE-2026-42592
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Gotenberg versions prior to 8.32.0
Description
A DNS rebinding issue exists in the
FilterOutboundURL function. The software resolves a hostname to check it against a private-address deny-list but discards the resolved addresses. Because Chromium performs its own independent DNS resolution when navigating to a URL, an attacker controlling a hostname with a short Time to Live (TTL) can return a public IP during the initial check and a private IP during the actual connection. This creates a timing window between the check performed by the Fetch.requestPaused handler and the TCP connection. Consequently, an unauthenticated attacker can bypass the deny-list to access internal HTTP services on the loopback interface, cloud metadata endpoints, or other private-network addresses, receiving the rendered internal response as a PDF.Recommendations
Update to version 8.32.0.
As a temporary workaround, restrict access to the network or use the
--chromium-host-resolver-rules flag to manually map hostnames to specific IPs.Exploit
Fix
Time Of Check To Time Of Use
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Gotenberg